CVE-2024-5617

Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks

Published Nov 2, 2026 CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Description

The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.

This functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WSO2

WSO2 API Manager

unaffected

Version	Status	Constraints
`0`	unknown	< 4.0.0
`4.0.0`	affected	< 4.0.0.298
`4.2.0`	affected	< 4.2.0.95
`4.3.0`	affected	< 4.3.0.13

WSO2

WSO2 Identity Server

unaffected

Version	Status	Constraints
`0`	unknown	< 5.11.0
`5.11.0`	affected	< 5.11.0.348
`6.0.0`	affected	< 6.0.0.194
`6.1.0`	affected	< 6.1.0.162
`7.0.0`	affected	< 7.0.0.33

WSO2

WSO2 Carbon Identity Management

unknown

Version	Status	Constraints
`5.18.187`	affected	< 5.18.187.259
`5.23.8`	affected	< 5.23.8.180
`5.24.8`	affected	< 5.24.8.5
`5.25.92`	affected	< 5.25.92.84
`5.25.705`	affected	< 5.25.705.5
`7.0.78`	affected	< 7.0.78.19

WSO2

WSO2 Carbon User Manager Kernel

unknown

Version	Status	Constraints
`4.6.1`	affected	< 4.6.1.114
`4.7.1`	affected	< 4.7.1.53
`4.8.1`	affected	< 4.8.1.16
`4.9.0`	affected	< 4.9.0.58
`4.9.26`	affected	< 4.9.26.7
`4.10.9`	affected	< 4.10.9.17

No data.

Vendor Product Versions

Wso2

Api Manager

Version	Status	Scheme	Platform
`[4.0.0,4.0.0.298)`	affected	generic	—
`[4.2.0,4.2.0.95)`	affected	generic	—
`[4.3.0,4.3.0.13)`	affected	generic	—

Wso2

Identity Server

Version	Status	Scheme	Platform
`[5.11.0,5.11.0.348)`	affected	generic	—
`[6.0.0,6.0.0.194)`	affected	generic	—
`[6.1.0,6.1.0.162)`	affected	generic	—
`[7.0.0,7.0.0.33)`	affected	generic	—

Wso2

Wso2 Api Manager

Version	Status	Scheme	Platform
`[4.0.0,4.0.0.298)`	affected	generic	—
`[4.2.0,4.2.0.95)`	affected	generic	—
`[4.3.0,4.3.0.13)`	affected	generic	—

Wso2

Wso2 Carbon Identity Management

Version	Status	Scheme	Platform
`[5.18.187,5.18.187.259)`	affected	generic	—
`[5.23.8,5.23.8.180)`	affected	generic	—
`[5.24.8,5.24.8.5)`	affected	generic	—
`[5.25.92,5.25.92.84)`	affected	generic	—
`[5.25.705,5.25.705.5)`	affected	generic	—
`[7.0.78,7.0.78.19)`	affected	generic	—

Wso2

Wso2 Carbon User Manager Kernel

Version	Status	Scheme	Platform
`[4.6.1,4.6.1.114)`	affected	generic	—
`[4.7.1,4.7.1.53)`	affected	generic	—
`[4.8.1,4.8.1.16)`	affected	generic	—
`[4.9.0,4.9.0.58)`	affected	generic	—
`[4.9.26,4.9.26.7)`	affected	generic	—
`[4.10.9,4.10.9.17)`	affected	generic	—

Wso2

Wso2 Identity Server

Version	Status	Scheme	Platform
`[5.11.0,5.11.0.348)`	affected	generic	—
`[6.0.0,6.0.0.194)`	affected	generic	—
`[6.1.0,6.1.0.162)`	affected	generic	—
`[7.0.0,7.0.0.33)`	affected	generic	—

Remediation

Vendor Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/#solution

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.221% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/

History

Nov 2, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Nov 2, 2026 9:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wso2 api Manager Wso2 identity Server
Vendors & Products		Wso2 api Manager Wso2 identity Server

Nov 2, 2026 6:00 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account. This functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.
Title		Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks
First Time appeared		Wso2 Wso2 wso2 Api Manager Wso2 wso2 Carbon Identity Management Wso2 wso2 Carbon User Manager Kernel Wso2 wso2 Identity Server
Weaknesses		CWE-799
CPEs		cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_management:::::::: cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:::::::: cpe:2.3:a:wso2:wso2_identity_server::::::::
Vendors & Products		Wso2 Wso2 wso2 Api Manager Wso2 wso2 Carbon Identity Management Wso2 wso2 Carbon User Manager Kernel Wso2 wso2 Identity Server
References		https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}`